sorry...i skim through what i read before i have the chance to digest it clearly. here's the dds.txt, and i attached the "attach.txt"
i have noticed that both my windows xp sp3 computer and my toshiba laptop windows xp sp3 (wi-fi) redirect their windows update to msn, and both seem to be running extremely slow. furthermore, my other computer, a windows 2000 no longer can run mcafee freescan, saying my internet explorer is not supported when it really is. i'm guessing this virus/trojan problem has spread to all computers in the house.
*the logs i have posted came from my windows xp sp3 computer.
DDS (Version 1.1.0) - NTFSx86
Run by Owner at 19:59:34.71 on 01/05/2009 Mon
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.936.86.1033.18.254.26 [GMT -5:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\TPPALDR.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Owner\Desktop\dds.com
C:\WINDOWS\system32\conime.exe
============== Pseudo HJT Report ===============
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program
files\real\realplayer\rpbrowserrecordplugin.dll
BHO: FlpLauncher Class: {4401fdc3-7996-4774-8d2b-c1ae9cd6cc25} - c:\progra~1\e-book~1\flipvi~1\fplaunch.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {A057A204-BACC-4D26-CEC4-75A487FD6484} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [Sonic RecordNow!]
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [TPP Auto Loader] c:\windows\TPPALDR.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [PerfectOptimizer] c:\program files\perfect optimizer\PerfectOptimizer.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\symant~1.lnk - c:\program files\microsoft office\office\1033\OLFSNT40.EXE
IE: ìí?óμ?QQ±í?é
IE: ìí?óμ?QQ±í?é - c:\program files\tencent\qq\AddEmotion.htm
IE: 添加到QQ表情 - c:\program files\tencent\qq\AddEmotion.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - {EC4548D7-1F09-4FC2-BB95-E34724CF3D60}
http://uk.trendmicro-europe.com/ente...secall_pre.php
-
http://uk.trendmicro-europe.com/ente...inprocserver32 does not exist!
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
============= SERVICES / DRIVERS ===============
R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]
S3 Alidevice;Alidevice; [x]
S3 TPP725;USB Storage Adapter (TPP);c:\windows\system32\drivers\TPP725.SYS [2004-3-7 43269]
============== File Associations ===============
chm.file="hh.exe" %1
txtfile=c:\windows\notepad.exe %1
=============== Created Last 30 ================
2009-01-03 23:21 <DIR> --d----- c:\program files\Perfect Optimizer
2009-01-03 23:01 <DIR> --d----- c:\program files\RegistryFix7
2009-01-01 17:04 73,728 a------- c:\windows\system32\javacpl.cpl
2009-01-01 16:59 0 a------- c:\windows\system32\REN79.tmp
2009-01-01 16:59 0 a------- c:\windows\system32\REN78.tmp
2009-01-01 14:18 <DIR> --d----- c:\program files\fxsolutions
2009-01-01 01:24 <DIR> --d----- c:\program files\common files\Tencent
2009-01-01 01:23 <DIR> --d----- c:\program files\Tencent
2009-01-01 01:23 <DIR> --d----- c:\docume~1\owner\applic~1\Tencent
2008-12-30 13:33 <DIR> --d-h--- c:\program files\InstallJammer Registry
2008-12-30 12:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Marlin
2008-12-30 12:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\kinoma
2008-12-28 21:57 0 a------- c:\windows\NSREX.INI
2008-12-28 21:53 <DIR> --d----- c:\windows\system32\Viewers
2008-12-28 21:51 <DIR> --d----- c:\program files\Snapshot Viewer
2008-12-28 21:51 <DIR> --d----- c:\windows\Twain32
2008-12-26 16:30 <DIR> --d----- c:\windows\ShellNew
2008-12-24 17:21 5,632 a------- c:\windows\system32\ptpusb.dll
2008-12-24 17:21 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2008-12-24 17:21 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2008-12-24 17:21 159,232 a------- c:\windows\system32\ptpusd.dll
2008-12-24 12:30 63 a------- c:\windows\system\SysSD.dll
2008-12-21 17:38 <DIR> --d----- C:\KAV
2008-12-19 12:20 3,538 a------- c:\windows\system32\tmp.reg
2008-12-19 12:17 82,944 a------- c:\windows\system32\IEDFix.C.exe
2008-12-19 12:17 82,432 a------- c:\windows\system32\404Fix.exe
2008-12-19 12:17 80,384 a------- c:\windows\system32\o4Patch.exe
2008-12-19 12:17 78,336 a------- c:\windows\system32\Agent.OMZ.Fix.exe
2008-12-19 12:17 87,552 a------- c:\windows\system32\VACFix.exe
2008-12-19 12:17 82,944 a------- c:\windows\system32\IEDFix.exe
2008-12-19 12:17 79,360 a------- c:\windows\system32\swxcacls.exe
2008-12-19 12:17 288,417 a------- c:\windows\system32\SrchSTS.exe
2008-12-19 12:17 135,168 a------- c:\windows\system32\swreg.exe
2008-12-19 12:17 51,200 a------- c:\windows\system32\dumphive.exe
2008-12-18 20:52 23,576 a------- c:\windows\system32\wuapi.dll.mui
2008-12-18 19:21 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2008-12-10 12:52 <DIR> --d----- c:\program files\VTTrader 2
==================== Find3M ====================
2009-01-01 17:03 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-26 16:33 5,058 a------- c:\windows\help\hhcolreg.dat
2008-10-23 07:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-16 15:38 826,368 a------- c:\windows\system32\wininet.dll
2008-10-16 14:07 208,744 a------- c:\windows\system32\muweb.dll
2008-03-14 18:00 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat
2001-10-05 11:53 21,866 a------- c:\program files\common files\tppupd2k.dll
1998-12-08 21:53 186,368 a------- c:\program files\common files\IRAREG.DLL
1998-12-08 21:53 99,840 a------- c:\program files\common files\IRAABOUT.DLL
1998-12-08 21:53 70,144 a------- c:\program files\common files\IRAMDMTR.DLL
1998-12-08 21:53 48,640 a------- c:\program files\common files\IRALPTTR.DLL
1998-12-08 21:53 31,744 a------- c:\program files\common files\IRAWEBTR.DLL
1998-12-08 21:53 17,920 a------- c:\program files\common files\IRASRIAL.DLL
2008-08-19 13:14 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008081920080820
\index.dat
============= FINISH: 20:00:51.75 ===============